CVE-2026-98432 — Linux kernel TCP use-after-free

On the 15th of October, 2026, CVE-2026-98432 was published. It is a use-after-free vulnerability in the Linux kernel IPv4 TCP stack. It has been assigned a HIGH priority by Ubuntu and a CVSS 3 score of 9.8 (Critical).

When a TCP connection is established, ownership of the IP options from the connection request is handed to the new child socket without being copied. If another CPU is concurrently processing a retransmitted SYN for the same request, it can still be reading those options while the child socket frees them, resulting in a use-after-free in the kernel. The fix in the upstream kernel is to free the options after an RCU grace period. See the Ubuntu security tracker for more information.

Impact to LiquidFiles

Does this impact LiquidFiles — Yes, at the operating system level.

The vulnerability is in the Linux kernel shipped with Ubuntu 22.04 LTS, which LiquidFiles is built on. It is not in the LiquidFiles application code. The attack vector is the network, with no privileges or user interaction required, and the main impact is on availability.

This is a kernel issue, so no LiquidFiles application update can fix it. Ubuntu lists the fix for 22.04 LTS (jammy) as work in progress.

When will this be fixed

This will be fixed when Ubuntu releases an updated kernel for Ubuntu 22.04 LTS. You can check the current patch status on the Ubuntu security tracker.

When the kernel update is released and you have Automatic Updates enabled as recommended, the updated kernel package will be installed automatically. A reboot is needed to start using the new kernel.